The 30-second version
A protocol pays LPs to bear impermanent loss by emitting tokens forever. That is a premium, paid in the worst possible currency. Volatus lets a protocol buy the same risk transfer as insurance instead — priced by a market, settled in USDC, for a term that ends.
- A v4 hook measures how much a pool is actually moving, straight from its own swap data. No oracle.
- Two tokens trade against that measurement — STORM pays out when it moves, CALM pays out when it stays quiet. What they trade at is implied volatility.
- A treasury buys STORM for its LPs, or takes the other side itself: post USDC, mint pairs, hand STORM to LPs in place of emissions, keep CALM.
Liquidity mining is an insurance premium paid in inflation. Volatus turns it into a market.
Who’s on each side
| Actor | Puts in | Gets out |
|---|---|---|
| Protocol treasury (buyer) | USDC premium | LPs hedged, without emissions |
| Token owner as underwriter | USDC collateral | STORM to distribute, CALM retained |
| Liquidity provider | Nothing, or a small premium | Fee yield with the price risk stripped out |
| Volatility seller | Buys CALM | Premium income, loss capped by design |
| Any protocol | One view call | Market-implied volatility |
The second row matters most for bootstrapping: a protocol underwriting its own pool needs no counterparty at all. It mints both legs, keeps one, distributes the other — that path works on day one, with nobody else in the market.
The problem
| Emissions | What insurance should be | |
|---|---|---|
| Cost | Permanent dilution, paid regardless | Pay for realized risk |
| Pricing | Set by governance guesswork | Set by a market |
| Duration | Compounds forever | Ends when the term ends |
| Retention | Liquidity leaves when emissions slow | Nothing to leave — risk transferred, not rented |
A concentrated liquidity position is, in payoff terms, a short straddle: fees collected as premium, losses in either direction. LPs are short gamma and were never told, and nothing lets them know how much, buy protection against it, or price that protection — outside BTC/ETH, nowhere.
The mechanism
Three layers. The first two live on Uniswap; the third is a payment rail.
- swapthe pool
Someone trades against the pool and the tick moves.
- Δticka log price
That move is a change in a log price — a Uniswap tick already is one.
- Σ(Δtick)²accumulator
Squared and added on every swap. That running sum is realized variance.
- STORM · CALMerc-20 pair
At epoch end the accumulated variance splits one dollar between the two legs.
- impliedVol()any contract
A view call. Any contract reads today's volatility number from it.
Layer 1 — measurement
A Uniswap tick is already a log price: tick = log₁.₀₀₀₁(price). Realized variance is a sum of squared tick deltas — no logs, no oracle, no external feed.
realizedVariance(epoch) = Σ (Δtickᵢ)² × (ln 1.0001)²Layer 2 — settlement
Strike K and cap C normalize the accumulator into a payoff in [0, 1]. Both legs floor independently, so the pair can never redeem for more than 1 USDC combined.
V = accumulator * (ln 1.0001)^2
p = clamp(V - K, 0, C - K) / (C - K)p USDC1 − p USDCLayer 3 — coverage as a subscription
Circle Nanopayments removes the batching floor — gas-free USDC transfers down to $0.000001, verified in under a second, batched onchain later. A treasury streams premium per second at the prevailing market IV; coverage accrues tick by tick and lapses the moment the stream stops. No term, no expiry, no lockup.
Manipulation resistance
The index settles money, so it has to resist a STORM holder wash-trading the pool to manufacture variance. Three structural defenses, and the second one is measured, not argued.
test/fuzz/ManipulationCost.t.sol.MAX_TICK_DELTA bounds any single observation, so a one-block dislocation cannot dominate an epoch.The honest form of the claim is conditional: there is always some position large enough to fund an attack. The defenses put it multiple orders of magnitude above the attack’s cost, not out of reach in principle.
Architecture
Two chains, two jobs. The index, the collateral and settlement live entirely on Unichain. Arc is a payment rail for a subscription — never part of settlement.
Measurement · price discovery · settlement
- Underlying v4 pool — every swap moves the tick
VolatusHook— accumulates variance inafterSwapVolatusVault— mint / burn / settle, holds USDC collateral- Variance v4 pool — STORM / USDC, where IV is discovered
VolatusOracle—impliedVol(), the public feed
Streaming premium — the payment rail only
VolatusStream— subscription registry, coverage accrual- Underwriter capacity, posted in USDC
- USDC is simultaneously native gas and an ERC-20 — same funds, two views
- A permissionless
synckeeper, gated on gas-vs-premium economics - If Arc is unavailable, streams stop and coverage lapses — nothing is stuck
Epoch lifecycle
Contract surface
The integration point for any other protocol is one view call. Everything else is the vault a treasury actually calls.
interface IVolatusOracle {
/// Market-implied volatility for a pool, annualized, 1e18 fixed point.
function impliedVol(PoolId id) external view returns (uint256);
/// Realized variance accumulated so far in the current epoch.
function realizedVariance(PoolId id) external view returns (uint256);
function epoch(PoolId id)
external view returns (uint64 endBlock, uint256 strike, uint256 cap);
}interface IVolatusVault {
/// Deposit `amount` USDC, receive `amount` of each leg.
function mintPair(PoolId id, uint256 amount) external;
/// Return one of each leg before settlement, receive USDC back.
function burnPair(PoolId id, uint256 amount) external;
/// Freeze the payoff from the accumulator. Permissionless after endBlock.
function settle(PoolId id) external returns (uint256 payoffX18);
/// Redeem a settled leg for its share of collateral.
function redeem(PoolId id, bool long, uint256 amount) external;
}One line reads the whole feed: uint256 iv = volatusOracle.impliedVol(poolId);
Deployments
Live, testnet only. These are the same constants the app and the backend services read — one source of truth, so this list cannot drift from what is actually deployed.
0xE44b6a47b29b097CE5c20BF17830cfb5df7343540x3600000000000000000000000000000000000000Read the number yourself: cast call 0x51f7D166FE0C040F9e9Ee7236Bc3dC3E2183B33a "impliedVol(bytes32)(uint256)" <poolId> --rpc-url https://sepolia.unichain.org
Agents & delegation
Two agents hold Circle Wallets and act on signals read from the contracts above, not from prompts. A continuously-priced market only exists if both sides reprice every tick — no human requotes a volatility surface every second.
| Agent | Signal | Action |
|---|---|---|
| Hedger (treasury side) | Gamma exposure × live accumulator; IV from the vol pool | Adjusts streamed rate and coverage notional within the mandate |
| Underwriter (seller side) | Realized vs implied spread; inventory concentration | Requotes offered rate; withdraws capacity as risk concentrates |
Privy secures the delegation. The agent signs with a session signer under a TEE-enforced policy — a compromised backend cannot move a treasury’s funds anywhere except into premium payments on the pool it authorized, and cannot exceed the mandate.
Policy: volatus-hedger-v1
|- allow method: streamPremium | adjustCoverage
|- allow target: VolatusStream only
|- deny all ERC20 transfers to other recipients
|- cap cumulative spend <= declared mandateLimitations
Stated plainly, because a judge will find them anyway.
- Testnet only, on Unichain Sepolia and Arc Testnet. Nothing here moves real funds.
- Liquidity in the vol pool is seeded by the team and the demo counterparty is a script — the mechanism of price discovery is demonstrated, its depth is not.
- The reporter that mirrors settlement onto Arc is a single held key today, not a multisig — the one privileged role in the system.
- Manipulation resistance is measured against a specific attack shape, not proven against every conceivable one — see
ManipulationCost.t.sol.